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[57] 


ABSTRACT 


A means and method is disclosed for displaying an image on 
a display screen graphically representing the topology and 
information transfer activity occurring on a computer net- 
work One host computer on the network denoted a network 
monitor gathers information about the topology and traffic 
on the network. A display image is generated depicting a 
substantially circular arrangement of host computers and/or 
sub-networks of host computers comprising the network 
Color-coded, dashed, various width, or shaded line segments 
are added to the display image representing traffic 
(information transfer activity) occurring on the network 
between source and destination host computers. Line seg- 
ments between communicating hosts are coded depending 
upon the volume of informatioQ being transferred Line 
segments are removed when information flow between a 
pair of hosts ceases. Controls are provided to configure the 
display of the network and to move or zoom in on a portion 
of the display image. 

79 Claims, 13 Drawing Sheets 
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GRAPHICAL REPRESENTATION OF alphanumeric input device, a cursor control device for 

COMPUTER NETWORK TOPOLOGY AND interactively positioning a cursor on a display screen, and a 

ACTIVITY signal generation device. In addition, the computer system 

of the present invention includes a means for connecting the 
This is a continuation of application Sex. No. 0&/087 ,137. 5 computer system to a computer network. The present inven- 
ted Jul. 2, 1993, now abandoned, which is a continuation tion ^j* 1 ™ Pf ^ °*J formation traversing through the 
of application Ser. No. 07/590,670, filed Sep. 28, 1990, now ne ^°* *? d * ose °f a 
abandoned packet is decoded, me information obtained is appended to 

a network data base in the memory of a monitoring computer 
BACKGROUND OF THE INVENTION 10 system. The present invention then manipulates the relevant 

information in the data base and generates a substantially 

1. Field of the Invention circular graphical representation of the network topology 
The present invention pertains to the field of computer and activity as determined by the information in the packets 

networks. Specifically, the invention pertains to graphically of information decoded. The substantially circular graphical 
displaying the network topology and the information inter- representation may be depicted as circles, ellipses, or multi- 
change activity occurring on the network. sided polygons. A graphical depiction of network activity is 

2. Prior Art then displayed on the display device. 

Computer networking has become a very popular and The substantially circular graphical representation of the 

powerful form of exchanging information between host network topology and activity may represent a network 
computers and other local area networks or sub-networks. In 20 com P r i sul S simply host computers or a network comprising 

a typical network, the ability of the network to efficiently and mix of host computers and sub-networks or local area 

quickly transfer data between nodes on the network is networks. Further, controls are provided for tailoring the 

always a concern to a network administrator responsible for display in order to target a particular type of information, 

insuring the smooth and optimal performance of the net- The graphical representation provides means for color cod- 
work. The network administrator's job is complicated by the 25 * D 8 nost computer images, network images, and information 

dynamic nature of computer networks. As host computers or transfer activity images in order to highlight status and other 

sub-networks are added or removed from the network topoi- information. For example, information transfer activity 

ogy or local area networks are reconfigured, the overall images are color coded to indicate the level of traffic flow 

network topology is often times subject to change. occuring between two nodes. Traffic flow level may also be 
Moreover, the volume of information exchanged between 30 represented by varying the thickness of the lines connecting 

nodes (hosts) on the network is usually unpredictable. Data communicating hosts. In addition, coding may be used to 

interchange paths through some nodes may introduce bottle- represent categories of hosts or information packet types 

necks while other paths are mostly dormant. Another (i-e- TCP, ethernet etc.). 

responsibility of a network administrator is the task of load This invention provides a means and method for over- 
balancing for optimized information sharing between host 35 coming the failure of prior systems of being able to graphi- 
computers. cally display network topology and activity on a computer 

Id order for a network administrator or a network user to display screen in real-time, 

effectively manage or use a computer network, the admin- BRIEF DESCRIPTION OF THE DRAWINGS 

istrator or user must be able to obtain timely information __ , . .„ _ * k 

related to the current topology and data transfer activity 40 HG ; 1 ^T°Vl 

occurring on the networtln fee past, this information has turc ° f » ^ COm P Uler of me *™oo. 

r*imarily existed in the form of textual or hexadecimal FIG. 2a is a pnor art depiction of a display of a typical 

dumps depicting the network information traffic patterns. In computer network. 

these prior art systems, it is a responsibility of the network FIG. 26 is a depiction of the display of a substantially 

administrator to sift through these dumps in an effort to 45 circular arrangement of hosts using the present invention, 

analyze the operation of the network. Not only is this dump FK}. 2c is an alternative embodiment of the depiction of 

analysis very time consuming and expensive, but ultimately, the display of a substantially circular arrangement of hosts 

the information gathered by this analysis is incomplete and ^ a multi-sided polygon shape. 

not in real-time relation to the actual network activity. Using FIG. 3a is a depiction of the display of a substantially 

the prior art approach, network problems, bottle-necks, or 50 circular arrangement of hosts and sub-networks of hosts, 

security breaches are very difficult to detect Further, ways FIG. 36 is an alternative embodiment of the depiction of 

of reconfiguring the network in order to alleviate a problem the display of a substantially circular arrangement of hosts 

is more difficult to discover. A better method for computer and sub-networks of hosts in a multi-sided polygon shape, 

network administration is needed, FIG. 3c is an alternative embodiment of the depiction of 

SUMMARY OF THE INVENTION ^ SSTT^^S^S 

The present invention provides a means and a method for where each sub-network is itself depicted as a multi-sided 

graphically displaying on a display screen the topology and polygon shape. 

information transfer activity occurring on a computer net- FIGS. 4 and 5 are illustrations of the operation of the 

work The present invention enables a network administrator 60 preferred embodiment within windows on a display screen, 

or a network user to visually monitor activity on the network pjes m flowcharts of the processing logic of the 

from a central vantage point The present invention com- present invention, 
prises an interactive computer-controlled display system 

including a bus for interconnecting system components, a DETA 5d?5 DESCRIPTION OF THE 

processor, a random access memory (RAM), a read-only « PREFERRED EMBODIMENT 

memory (ROM), a data storage means for storing data, a The present invention provides a means and method for 

display device including a display screen, and optionally an graphically displaying the network topology and informa- 
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tion transfer activity on a computer network. The following FIG. 1. It will be apparent to those skilled in the art that each 
detailed description describes a preferred embodiment of the of the hosts depicted in FIG. la may be configured differ- 
network analysis system of the present invention as a means ently from the system shown in FIG. 1. Some basic system 
for managing a computer network in this manner. components, however, such as processor 101, random access 

A preferred embodiment of the present invention is imple- 5 memory 102, and network interface 109 will most likely be 
mented on a computer system as depicted in FIG. 1. In common to all hosts connected to the network 200 depicted 
general, such systems comprise a bus 100 for communicat- [q fig. 2a 

ing information, a processor 101 coupled with said bus 100 Another system component common to all hosts shown in 
for processing information, a random access memory nG ^ fe op€xatiBg ^tem software and network system 
(RAM) 102 coupled with said bus 100 for storing informa- 10 software rcsidiDg m random access memory 102, read-only 
tion and inst^ons for said ^"^^ memory 103, and/or data storage device 104 of each host 
memory (ROM) 103 copied with said bus 1W > to *nng orating system software is executed by processor 101 and 
static information and instructions for said processor 101. a 6 . 3 . , ' 

STsZ^vice 194. such «s a magneticdisk and disk P™i<tes the logic necessary for computer system resource 
Se Sedwith said bus 10» for3ng infonnatioo and „ «* Usk .nanagement Network system software is also 
SS.adisplaydevicel^incSadispUyscreen 15 executed by processor 101 and ^ovides fte logic necessary 
uijuutuuw, 7 . , r . ^ »„ for communicating via network interface 109 with other 

coupled to said bus 100 for hosts on network 200. Operating system software and net- 

computer user, optionally an a^anumenc input device 106 » j^rarnponents weU known to those 

including alphanumeric and function keys coupled to sail wor* system swwate *uc wwupuucui* w«i 
bus 100 for corrununicating information and command ^ 5jaUcd 10 ^ computer art. 

selections to said processor 101, a cursor control device 107 20 Information is transferred between host computers on the 
coupled to said bus 100 for communicating information and network using information packets. An information packet is 
command selections to said processor 101, a signal genera- a group of computer words or bytes comprising control and 
tion device 108 coupled to said bus 100 for cornmuiiicating data information. The control information for each packet 
command selections to said processor 101, and a network typically contains a source and destination host address 
interface 109 fox coupling said computer system to a net- associated with the information packet In this manner, the 
work for transmitting and receiving information packets information packet can be properly routed to the appropriate 
to/from other host computers or other computer networks. destination host The data portion of the information packet 
The display device 105 may include a liquid crystal contains the information to be transferred from one host 
device, cathode ray tube, or other suitable display means. M computer to another. The network system software execut- 
ive cursor control device lfT allows the computer user to 30 ™& ^ each host computer is responsrble for managing the 
dynamically signal the two-dimensional movement of a receipt and transmission of information packets over net- 
visible symbol on a display screen of said display device work200.This scheme of infommUon transfer over a typical 
105. Many implementatioiis of the cursor control device are network * * well known technique known in the computer 
known in the art including trackball, mouse, joy stick, or 35 art 

special keys on the alphanumeric input device 106 capable The present invention provides a means for visually 
of signally movement in a given direction. The network representing the topology and information transfer activity 
interface 109 is also a standard component well known in the occurring on a typical network. In this way, the performance 
computer art Many different network protocols may equiva- of a network can be effectively monitored and problems 
ientiy be supported by the network interface 109 of the ^ quickly identified and resolved. Referring to FIG. 2b, net- 
present invention. For example, the network interface 109 work 200 is logically shown as a substantially circular 
may be compatible with ethernet XTP.TCR decnet or other arrangement of host computers connected by a circle 201 
common network protocols. representing the information transfer path. In FIG. 2b r each 

The features and design of the present invention are host computer is associated with a unique position on the 
described below. The general operation of the display 45 substantially circular shape 201. The substantially circular 
device, cursor control device, or network interface is arrangement of network hosts shown in FIG. 2f> is a better 
described only where necessary to provide a thorough arrangement for displaying network topology and network 
understanding of the present invention, since these methods information transfer activity than the linear arrangement of 
are known to those of ordinary skill in the art FIG. 2a or other non-circular arrangements. This scheme of 

Referring to FIG. la, a typical computer network is * the present invention is better because a substantially cir- 
depicted. This network 200 comprises a plurality of host cular arrangement assures no logical connection between 
computers (HOSTS 11-18) connected with an information two hosts will be co-linear, thus not visible, 
transfer path 201. Information transfer path 201 may be Referring again to FIG. 2b, currently active informauon 
implemented as an electrical cable, a fiber-optic cable, a transfer activity is shown by line segments 202-205. Thus, 
microwave link, or other means for transferring information 55 in the sample network of FIG. 2b r information packets are 
between two computing devices. These modes of data actively being transferred between HOST 18 and HOST 12 
transfer between computers are well known techniques in (tine 202), HOST 18 and HOST 15 (line 203), HOST 16 and 
the computer art HOST 14 (line 204), and HOST 12 and HOST 13 (line 205). 

In a typical computer network, the host computers con- This same information transfer activity cannot be shown 
nected to the network may be physically located in any eo usin 8 arrangement in FIG. 2a since the paths between 
arbitrary configuration. However, as depicted in FIG. 2* the hosts are co-linear, thus not distinctly visible. This is also the 
logical topology of a computer network may be shown as a case for other arrangements of hosts that are not substan- 
liaear arrangement of host computers all connected with a tially circular. 

line 201 depicting the information transfer path used to Id an alternative embodiment, the substantially circular 
transfer information between hosts on the network. 65 arrangement of network hosts may be implemented as a 

As described earlier, each of the hosts depicted in FIG. 2a multi-sided substantially circular polygon as shown in FIG. 
comprise a computer system similar to the one depicted in 2c. In this alternative embodiment the total quantity of 
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network hosts existing in the network is factored into the FIG. 3c, each of the sub-networks 1-3 are themselves 

logical arrangement of host representations presented on the displayed as a substantially circular arrangement of hosts 

display screen. Specifically, a polygon is generated with a using the same method of arranging with a multi- sided 

number of sides twice the number of network hosts. The polygon shape with a number of sides corresponding to the 

representations of network hosts arc then evenly distributed 5 number of hosts. Thus, sub-network 1 uses a 16-sided 

around the polygon. This even distribution may be accom- polygon because of the 8 member hosts, sub-network 2 is 

plished by associating alternate corners of the polygon with represented by a six sided polygon because of the 3 member 

a network host as shown in FIG. 2c. Equivalently, a polygon hosts, and sub-network 3 uses an eight sided shape because 

with a multiple of twice the number of network hosts may of the 4 member hosts. Note that the number of sides for the 

be generated. Note that the polygon shape approaches a polygon can equivalently be an integer multiple greater than 

circle as the number of sides increases. In another alternative two times the sum of the number of hosts and sub-networks, 

embodiment, an elliptical or oblong arrangement may be The individual hosts (i.e. Host 21 and Host 51) can be 

used to represent the network. Other equivalent shapes may represented by a point or dot, which also can be considered 

be employed showing unique line segments between com- a substantially circular shape. A unique position on each of 

muni eating nodes tnc SUD - network polygon shapes is associated with each host 

Referring to FIGS. 3a-c, the substantially circular 15 cornpmer memto of mat sub-n^ort 
arrangement of host computers displayed by the present ™* ^ion" embodied m the form of corn- 
invention can be extended to a network 300 wherein both P uter V 0 *™ lo f * f Sldm * » OT ™ rc J* * c ^ 

........ , . « . . , . _ computers connected to network 200 or network 300. This 

individual host computers and sub-networks or local area . . . . . , . , ► - 

1 ^ v ur ^ . „ j * • . i* 11 program logic can be denoted network monitor software, 

networks (LANs) are logically arranged in a substantially ™ £. ^ , ... „™« , . 

. x ♦ c • Dir-o * t 20 the purposes of illustration. HOST 13 in FIG. 2b is 

circular representation as shown in FIGS. 3a-c. In the . . * 1 r™ _ . 

e a w A m * e *u * • *: • j- -j i identified as a network monitor. The network monitor con- 
preferred embodiment of the present invention, individual _ . ^ _ . u ^ r " ^7 . 
host computers and sub-networks are arranged og a dicle mns D 1 f W0lk of fce present invention 
301. Circle 301 is not actually displayed with the other executed * P"*? 5 so f 101 and ^ m , random acccss 
taageson the display screen. The drele 3*1 is shown in „ T^™: meroory 1»3. and/or daU storage 
T7rr!h a l i * u- L ra. *u i * „r 25 device 104. It will be apparent to those skilled in the art that 
FIGS y*-b merely to highlight the circular arrangement of 0(her hosts on newor ^ or oetwork 30* may concur- 
the host computers and sub-networks. In an alternative . . 4 . . . 4 . 7 , . 

. «. A . . . . . . . . rently be executing the network monitor software of the 

embodiment of the present invention, individual host com- esent invention. 

puters and sub-networks are arranged in a substantially ^ , , 

circular representation using a multi-sided polygon 32L M The Processing logic of the present invenUon uses the 

Again, multi-sided polygon 321 is not actually displayed f«work system software described above to receive each 

with the other images on me display screen. The multi-sided "f«™ation packet sent across the network between any one 

polygon 321 is shown in FIGS. 3^c merely to highlight the host ~ m P u,er ' As "rfonnauon packd I is ; received by the 

circular arrangement of the host computers and sub- networt; mom ' or ; *? Portion of the information 

networks packet is decoded. Thus, the source and destination address 

In the network 300 of FIGS. 3«~. three sub-networks * ^ ^ packet T V "I??* . ^ ^ 

(Sub-networks 1-3) and two individual host computers A to ad^on, other control infcirmaaon such as the typeof 

(HOST 21 and HOST 51) exist on network 300. Each * e P™ 10 ? 1 <<* TCP - cmen » et - ^"j 

sub-network is itself displayed as a circular arrangement of "f"* a ? > assoclat f. ^ ith me "formation P^f and 

host computers. Sub-networks may themselves also contain 40 0ther f" 16 ?* "'T 1 mf ^ rmaUoD ^ ** c °" ectcd : T J 1C 

lowa-level networks in addition to individual host comput- netwo f k momtor «f onnation on network activity by 

ers. A unique position on each of the sub-network substan- dec ^ UI 8 information packets as they pass across the net- 

daily circular shapes is associated with each host computer wo 

member of that sub-network. B y scanning information packets passing across the 
As in the network of FIG. 26, the information transfer 45 ^^^tor of the present invention is 
activity in thecomplex network topology of FIGS.3o-cmay a ^V° t 3 containmg information related to 
be shown using line segments connecting source and desti- * e t0 P° l0 ^ ^d information transfer acUvity occurring on 
nation hosts. By virtue of the substantially circular arrange- me Us /f8 b , ase ' mc 
ment of hosts and sub-networks, each information transfer mowt0 * 15 ^ aWc t0 'generate a graphical representation of 
path between any two hosts may be uniquely represented. 50 nrtw °*f£ l0 ^ *" d T^l Refen | n 8, ^ . t0 nG ' f 
As described above, an alternative embodiment employ- ^ ^ GS * ^ JJ ctwork andinfonuaUwi toiisfer 
1^ a a 1 im^vmwm, j activity may be shown graphically by generating a plurality 
ing a mulu -sided polygon arrangement or representations of - - , r , .1 ^ & l T 1 . ^ 
. °, r f . J 1 , . ^ _i . . . of first geometric shapes each substantially resembling a 
host computers may be extended to a network containing , \ m . . . * ^ ~ / „ f 
v^uT . . . * . lA circular shape, each of said first geometric shapes represent- 
both host computers and sub- networks. This alternative . , _/ , . , . ^ e , r -j i_ . 

* j . . . A , . r~ 0 it t ^« *». mg at least one of said host computers, each of said host 

embodiment is illustrated in FIGS. 3p— c. In this case, the 55 . , . . . . . r 

totalquantity of mdependent host, is added to the number of ^ c ^ c a f h ?^? ,?,ed P 0 ^-"" one of sajd 

sub-networks to produce a number of positions necessary in ^ . c f" 4 ? 65 * . 

the arrangement. This number is then doubled (or multiplied arranging said plurahty of first geometric shapes in a 

by some larger integer than 2) to produce the number of substantially circular anangement, said arrangement corre- 

sides for the polygon shape. The representations of host 60 s P° adm 8 to ^ network ^P° 1 ^ and 

computers and sub-networks are then evenly distributed displaying said arrangement on said display device; 

around the polygon shape as described above. A unique receiving at least one information packet sent on the 

position on the polygon shape is associated with each host network by one of the host computers; 

computer or sub-network. In the examples shown in FIGS. decoding information contained in the information 

3fr-c. multi-sided polygon 321 is a 10 sided shape; since, 65 packet; and 

there are two individual hosts plus three sub-networks. Thus: displaying a line segment on the display device conoect- 

(2 hosts+3 sub-oetwork5)*2=10 sides. In the example of iug two positions associated with the host computers, the 
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location of the line segment corresponding to the informa- network map associated with the display in the viewing 

tion obtained in the decoding step. window 410. Window 412 is a control panel window used 

In addition, network activity may be shown with color- f <* ^JispUy of * 1°I 

coded, dashed or shaded line segments connecting two host uscr wuh me nctwork ™ OT of * c 

computers ^wecn which information packets ^ actively * ^ ^^^^ ^ FIG. 5. a graphical representation of a typical 

being transferred. Network jjcuvity may be equivalenUy ^ ^ ^ nsfar & ^ 

coded as a pamcular line width of a line sclent associated shoWQ wit ^ dewing window 410. The portion of the 

with information flow between two hosts. The color-coding, . e m yisible ^ viewing 410 ^ ^ changed 

or equivalent distinctive visual indication, may represent the wjth d t0 mon ^ wcU ^ scajc by usin g cit her the 

quality, quantity, or type of ^formation being transferred «> ^ Dtrol 107 or bars 510, 511 and 512 

between hosts. Such network activity line segments arc assodatcd with viewing window 410. The right scroll bar 

depicted in FIG. 26 and FIGS. 3a~c as line segments S10 - s u$ed t0 eDlarge me ^ displayed within viewing 

202-205 and 302-305. window 410. By moving the scroll bar 510 in a downward 

The present invention also provides a means for display- direction, the user can "zoom** in on a particular host, 

ing traffic between sub-networks of a network either in terms sub-network, or other selected area. The bottom scroll bar 

of traffic between endpoints (host computers originating an 5x1 ^ the left scroll bar 512 provide a means for moving 

information packet or being the final destination for an th e image relative to viewing window 410. The bottom 

information packet) or traffic between gateways. A gateway scro!1 bar 5^ ^ v icw of the image horizontally left 

is a particular host on a sub- network providing an interface or re iative to viewing window 410 as the image 

between the sub-network and other sub-networks or other follows the direction in which the scroll bar 511 is dragged 

hosts. The gateway is typically not the originator or final t>y cu^or control device 107. The left scroll bar 512 moves 

destination for an information packet, but merely a means the view of the image vertically up and down, relative to 

for routing packets from one sub-network to another. viewing window 410 as scroll bar 512 is moved up and 

In addition, the present invention employs security means ^ down. The view of the nctwork image 501 visible within 

for verifying the identity of a user activating the network viewing window 410 can also be changed by dragging 

monitor process of the preferred embodiment. Prior to cursor control device 107 within viewing window 410. This 

displaying network topology or activity information to a is accomplished by depressing signal generation device 108 

user, the identity of the user is checked against an access while cursor control device 107 is moved within viewing 

code maintained for the network. Access codes may equiva- ^ window 410. As this occurs, the view of the network image 

lently be maintained for each host computer and sub- 501 within viewing window 410 is moved in two dimen- 

network. sions in corresponding fashion with the two dimensional 

movement of cursor control device 107. When the appro- 
Operation of the Preferred Embodiment priate view me nc twork image 501 is obtained, the user 

As described above, the processing logic associated with 33 releases signal generation device 108 and the two dimen- 

the present invention is executed on one or more host sional movement of the view 501 within viewing window 

computers connected to a network. Host computers running 410 terminates. 

the processing logic of the present invention are denoted as The image displayed within network map window 411 

network monitors. When the processing logic of the present represents a reduced scale version of the network map image 

invention is first initiated by a network monitor, a visual ^ visible within viewing window 410. Since viewing window 

display similar to that shown in FIG. 4 is presented on 410 may be zoomed in or moved in such a way that the entire 

display device 105 associated with the network monitor. The network image 501 is not visible within the window 410. the 

display thus presented consists of three windows typically network map window 411 provides a means for displaying 

covering the entire display device 105. Each window has a an overview of the entire network image which is always 

discrete function. Each window can be stowed, moved, and 45 visible within network map 411. This overview of the 

manipulated using a stow box, a title bar menu, and a close network displayed within network map 411 can be used to 

box. These techniques for manipulating windows are well indicate the portion of the network currently in view in 

known in the art viewing window 410. Network map 411 may also be used to 

Referring to FIG. 4. the present invention displays a change the portion of the network currently in view within 

plurality of soft keys 401 used for operator communication 50 viewing window 410. 

with the program logic. These soft keys are activated by The network image displayed within network map win- 
manipulating the cursor control device to place a cursor dow 411 is enclosed in a yellow rectangle 450 at program 
symbol inside the box associated with a particular soft key. start up. This yellow rectangle 450 shows the area currently 
Upon activation of signal generation device 108, the pro- displayed in the viewing window 410. By manipulating the 
cessing logic of the present invention is notified of a 55 yellow rectangle 450 in network map window 411, the view 
particular command selection. Again, the use of soft keys in in viewing window 410 can be modified; the area of the 
the manner of the present invention is a technique well network in the yellow rectangle 450 continues to be as so- 
known in the computer art B will be apparent to those dated with the area of the network displayed in the viewing 
skilled in the art that other means for command selection are window 410. In this way. network map 411 can be used 
available. For example, an alphanumeric keyboard may be 60 instead of viewing window 410 to change the image that is 
used for command entry in place of soft keys. displayed within viewing window 410. Regardless of the 
The preferred ernbodiment of the present invention pro- position of the yellow rectangle 450 displayed within net- 
vides a means for displaying within windows on a computer work map 411, the network map 411 always shows the entire 
display device a graphical representation of the network known network. 

topology and information transfer activity occurring on a 65 In order to change the position of the yellow rectangle 450 

network of interest Such a display is depicted in viewing located in nctwork map 411 and thus, change the image 

window 410 of FIG. 5. Window 411 is used to display a displayed in viewing window 410, the cursor control device 
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107 is used in conjunction with signal generation device 10$ network number" option. The circles representing networks 

to drag the yellow rectangle 450 to the desired position displayed in viewing window 410 can be labeled by either 

within network map 411. In corresponding fashion, the the network name or the network address as specified by this 

image within viewing window 410 moves in a manner option 

associated with the Potion of the yellow rectangle 450 5 ^ foufth ^ b mc fiinctionSll 

located in network map 411. Thus, a means fo, ■ changing the . $ * ^ network from the map. Ihe network 

display of the image within viewing window 410 is provided a. « - ■ i « 

using means within network map 411. momt( * aUows ^ user to *W on f v 

The information displayed within viewing window 410 J*** 0 <**»**• U J"« *t network optzon^. the 

and network map 411 is dictated by a userwho is able to 1Q US 5 ™ ? ID0VC a netwark from mc 1x1 viewm * 

manipulate a menu of soft keys provided in a control panel W1 w 

window 412 as shown in FIG. 5. In the preferred The *host M function 522 provides a means for coiifiguring 

embodiment, the control panel window 412 is located in the mc wa y in whicb hosts monitored and displayed. Similar 

lower left hand portion of the display screen. To use the t0 * l netwo^k ,, function 521, "host" function 522 provides 

menu items provided by control panel 412, cursor control four °P tions for configuring hosts. First, an "add new host" 

device 107 is used to move a cursor symbol to a position 0,7 Mi S norc ^ hosr option is provided. If the network 

within a box associated with the desired menu option or soft monitor receives an information packet from an unknown 

key followed by an activation of signal generation device host - mc network monitor software will either add the new 

108. These actions simulate push buttons as a means of host 10 me network view or ignore it. based upon the option 

tuning or configuring the operation of the present invention. „ selection. If the "add new host* option is selected, the 

Most functions activated using the means provided within network monitor software can be configured to display host 

control panel 412 control a discrete aspect of the network Damcs ia any of four different name and address schemes, 

monitor software, while other functions allow access to The second option provided by the "host** function 522 is 

other menus, options, or the ability to save data to a file on the 'find host" option. When the network displayed in 

the computer system. In general, the functions provided by „ viewing window 410 is large and complex, the ability to rind 

control panel 412 control the items monitored and displayed a particular host is very useful. The 'find** option provides 

by the network monitor software of the present invention. a means for specifying a particular host by name or address 

Referring to FIG. 5, the "snoop" function 520 is used to so ^ me network monitor software may search for that 

start or stop the scanning of network traffic by a host particular host If the specified host is found, the view in 

Network traffic is the information transfer activity occurring ^ viewing window 410 is adjusted to display the desired host 

on the network. The name of a particular scanning host can larcd within viewing window 410. 

be specified when the "snoop** function is chosen. A third option provided by the host function 522 is the 

Equivalently, a separate snoop process may be initiated that "display route option". Using the "display route option'*, a 

gathers data for the network monitor and communicates with means for tracing the path taken by information packets 

it at periodic intervals or when polled by the network 35 leading to or from a particular host is provided. By tracing 

monitor. More than one snoop process may be concurrently the route taken by information packets, a network manager 

executed For example, a separate snoop process may be may be able to diagnose a bottleneck occurring at a partial- 

running in each of several sub-networks. Each process lar point in a network. In addition, other route display 

reports back to the network monitor. categories arc provided. For example, particular types of 

The "network" function 521 provides a means for con- 40 routes (TCP-IP or ethernet) may be specifically displayed, 

figuring the way in which networks are displayed within Route names may also be displayed, 

viewing window 410. By activating the "network" function The fourth option provided by the host function 522 is the 

521. four other options are provided for selection by a user. "delete host" option. Using this option, a user can remove 

First, the user may display all networks or only those from the network display 410 hosts not of interest 

networks that are active. Active networks are those actively 45 The "traffic" function 523 provides a means for config- 

involved in the transfer of information between hosts on the uring the characteristics of the display of network traffic 

network. If the "display all** option is selected, all networks (information transfer activity) in the viewing window 410. 

are displayed in light blue within viewing window 410. If As described earlier, the transfer of information packets 

the "display active only" option is selected, only active between two hosts on the network is displayed in viewing 

networks are displayed in light blue within viewing window 50 window 410 using a line segment connecting the sending 

410. Inactive networks are displayed in dark blue. and receiving host. The amount of traffic (quantity of 

Alternatively, active networks may be displayed in black or information) being transferred between hosts is represented 

white, while inactive networks are displayed in a pale gray. in viewing window 410 by color coded line segments drawn 

This alternative implementation may be used for display between communicating hosts. Alternatively, line segments 

devices without a color capability. 55 may be coded in shades of gray for display devices without 

The second set of options provided by "network" function a color capability. Similarly, dashed or dotted line segments 

521 is an "add new network** or "ignore new network* 1 or various line thicknesses may equivalently be used. The 

option. If the network monitor receives an information color or shade of the line segments is re- scaled every five 

packet from an unknown network, the processing logic will seconds by default based on the volume of information 
either add the network to the network map, or ignore it based 60 transfer activity (traffic) occurring during the previous five 

upon the option selected. Using the "add new network** second interval. This re-scale interval can be configured 

option allows a user to analyze information traffic from all using an option in the "traffic" function 523. 

available networks. Using the "ignore new networks** option The volume of traffic occurring between hosts on the 

allows the network manager to concentrate on networks network is measured in terms of the number of information 
already selected for viewing. 65 packets or the number of bytes as configured using an option 

The third option provided within the "network** function in 'traffic" function 523. The lowest volume of traffic is 

521 is the 'label networks by name** or "label networks by depicted as a purple or pale gray line while the highest level 
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of traffic is light green, white or black. The colors or shades 200. This processing logic is executed by processor 101 

displayed are used to convey subtle changes in the volume associated with the host computer in which the processing 

of traffic occurring between hosts. logic of the present invention is resident. 

"Traffic* 1 function 523 provides four options for config- The processing logic of the present invention (network 

uring the display of network traffic. The first option is the 5 monitor software) performs two basic functions. First, the 

'traffic re-scaling" option. Re-scaling denotes the calcula- network monitor software receives and decodes information 

tion and representation of the amount of traffic between packcts bdiig transferred on a network. This function is 

hosts in the network. This representation of traffic can either denoted ^ c network scanner. Secondly, the network 

be turned off or the interval between re-scaling operations moaItQr ^ftware includes a display generator function. This 

can be changed. ^ , ^ 10 component is denoted "the network display generator". In 

The second option in the 'traffic" function 523 is the ^ prcfcrrcd embodiment, the network scanner component 
'traffic time-out option". While information packets are and the network display generator component are two sepa- 
being transferred between hosts, a color-coded, dashed or fate softwarc components capable of being executed inde- 
shaded line segment is displayed in viewing window 410 p^^y concurrently by the same or a different host 
between the communicating hosts. Once the transfer of 15 computC r. jjj this manner, a visual display of network 
information packets ceases, the coded line segment connect- topology activity can be presented on one host computer 
ing the hosts is removed after a time-out period. The "traffic based 0D in f ormation packets captured and decoded by a 
time-out" option provides a means for configuring the length network ninning on a different host computer. In an 
of time after which the traffic connection or coded line alternative and equivalent embodiment, the network scan- 
segment fades from view, . ' „ 20 ning component and the network display generator compo- 

The third option in 'traffic" function 523 is the "scale nem ^ ^ combined into a single software component 
traffic option". Using this option, the scale with which traffic executing on a single host computer, 
quantity is calculated can be configured to be either the nGS ^ ^ sin logic for ^ me 
number of formation packets transferred or the number of Qetwork scaDQing component and the network display gen- 
bytes transferred between hosts. . _ *5 eration component Referring to FIG. 6. processing box 601 

The fourth option provided by traffic function 523 is a la5eled - starr azotes the initial starting point of the 

means for displaying traffic between networks either in processing logic for the network monitor software of the 

terms of traffic between endpoints or traffic between gate- present invention> ^j^n the network monitor software is 

ways. Using the "endpoint" or "gateway" option, the coded &st activatcd passing begins at processing box 601. 

line segment connecting communicating hosts can be either 30 me ne twork display generation component geuer- 

configured to connect the endpoints (the destination and atc$ vicwing window 410, network map 411, and control 

source host computer) or the gateway being used by a host panel 4U on me device 105. Next, the network 

computer within a sub-network. monitor software waits for an information data packet being 

Information packets transferred on a typical network may gent on the network or user input from one of the softkeys 

be one of several different types corresponding to the 35 401 m control panel 412. If the user chooses to configure the 

protocol used for the information transfer (e.g. TCP, operation of the network monitor program using one of the 

ethernet, XTP, decnet, etc.). Using the "protocol" function softkeys 40 1, processing flow continues at processing box 

524. traffic associated only with the protocols selected will ^ wncre ^ user is processed, as described earlier, 

be displayed in viewing window 410. In this way, the The processing flow men loops back to processing box 602 

monitoring of particular types of network protocols can be 40 ^ continues, as long as the user continues to provide 

targeted. When a protocol is selected using the protocol configuration input. 

function 524, all information packets classified as pertaining ff u Mom2tion ^ is detected by the network 

to that sdected protocol are displayed as ^lor-coded. ^ flow CO atinues at processing box 604 

dashed or shaded line segments in viewing window 410. where the information data packet is received and decoded. 

The 'Hie" function 525 provides a means for saving <5 ^ ^^^on <uta packet is first scanned for errors, such 

network information in a data file or data storage device 104. as parity ^5 occurring during transmission. If an error is 

The file function 525 provides a means for either opening a detect ed (decision path 606), the connection between the 

data file, saving the current network data to a data file or sending ^ ^mpum ^ me rece iving host computer is 

image file, or clearing all current data. By default, network doscd (processing to processing of network 

data is saved to the data file. 50 monitor so ftware terminates at termination box 609. 

Processing Logic of the Preferred Embodiment if qo error is detected in the information packet (decision 

The present invention includes computer program logic path 607), a procedure is activated for decoding the infor- 

for the operation of the network monitor and display system. mation in the information packet (procedure box 610). If an 

This program logic is described in the following section and 55 errot is detected in decoding the information packet during 

shown in FIGS. 6-11. In addition to the computer resources procedure call 610 (decision path 612); the connection 

described earlier, the present invention relies upon the between the sending and receiving host computers is closed 

availability of an operating system and system functions (processing box 614) and network monitor software is 

capable of displaying windows, graphical and textual infor- terminated at termination box 615. If no error is detected in 

mation within windows, alphanumeric characters, vectors, eo decoding (decision path 613), then processing control loops 

conies, and a cursor symbol on the display device. Some low back to the beginning of the processing flow starting at 

level system functions supporting the network interface of processing box 602. 

the present invention may also be required. These resources Referring to FIG. 7, the procedure for decoding an 

are standard computer processing components known in the information packet is illustrated. When the procedure call 

computer art. 65 for decoding an information packet 610 is activated as 

The processing logic of the present invention resides in shown in FIG. 6, the processing logic begins at processing 

one or more of the host computers connected to network box 701, as shown in FIG. 7. First the information packet 
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is scanned to determine if the information packet is a data tial order (processing box 902). Next, the display generation 
packet (decision box 702). If the packet is not a data packet process begins in processing box 903 with the positioning of 
(decision path 703). control returns from procedure 610 networks in a substantially circular arrangement The net- 
through terrnination box 705. If the packet is found to be a works currently existing in the network data base are posi- 
data packet (decision path 704), another test 706 is per- 5 tioned about a circle at a given initial radius (processing box 
formed to determine if the information packet conforms to ^3). If mc radius of the initial circle is too small to 
the protocol selected for monitoring during the configuration accommodate all of the currently known networks (decision 
process. If the information packet does not conform to a path 906), the radius of the circle is increased (processing 
selected protocol (decision path 707), control returns from box 907) and processing control loops back to processing 
procedure 610 through termination box 709. If the informs- 10 box 903 where another attempt is made to position the 
tion packet does conform to a selected protocol (decision networks around a circle of a now greater radius. This 
path 708). additional processing is performed to add the data process continues until the circle represented on the display 
packet to the network monitor display starting with process- is w 8 enough to accommodate all of the networks existing 
ing box 710. in the network data base. When this occurs (processing path 
Beginning at processing box 710 in FIG. 7, the network w 905 )* processing dro P s to termination box 908 where control 
number associated with the host that sent the captured returns from Posing call 806. 

information packet is retrieved. Next, two calls are made to Referring to FIG. 10. the processing logic associated with 

a procedure for decoding the address of the sending and procedure call 810 is illustrated This processing logic 

receiving host computers. First, the source address is performs the task of adding a new host to the network data 

decoded using a procedure call in procedure box 711. Next, 20 base. Processing begins at processing box 1001 where the 

the destination address is decoded using a procedure call in ncw nost is inserted in the network data base (processing box 

box 712. In both cases the processing logic for decoding the lf02 )- new host m inserted in such a way as to maintain 

address is depicted in FIG. 8 and described below. a S0Tt tog of hosts by address in the network data base. 

rk„~ m, nr^oc;„ n „<,iic 711 an A m ~~ ~ \-*-a Continuing at processing box 1003, the hosts currently 

Once the processing . calls 711 and 712 are completed, * netwc*k data base are positioned in a sub- 

another processing call 713 is made to update the connection 25 \ ~rf x . , _ *V " . 

between the source and destination hoTcomputcrs. The arrangement First the hosts known in the 

processing logic associated with procedure^aU 713 is ^J**?*^^ 1 * ^ ° f 3 

depicted in FIG. 11 and described below. Once the connec- imt,al "J* * * C J^ US ° f tte . ^ » *? * 

tion is updated using procedure call 713. control returns a ^rrutK>date aUof the hosts associated with this network 

from procedure 610 through termination box 714. 30 «2T ^ L ^ ^ c ^« ^ ucs at ? ro « ssul g ^ 

_ ... . , . 1008 where the networks currently existing in the network 

The processing logic associated with procedure calls 711 ^ basc wc positional about a circle of a given initial 

and 712 is depicted in FIG. 8 starting at processing box 801. radiuSt ff ^ u ^ ^ (p,^^* path 1O10)< 

First the network number associated with input host address rctums t0 processing box 1003 where the hosts are 

is determined in processing box 802. If this network number 35 again positioned about the circle. If the circle is too small to 

represents a new network not currently represented in the accommodatc au 0 f the hosts and networks (decision path 

network display (decision path 80S), a procedure call is lf U)( ^ radius of me cirdc is inched (processing box 

made 806 to add the ncw network to the network monitor 1012) ^ returns t0 processing box 1008 where the 

display image. The Focessing log! c associated with proce- networks are again positioned about the circle. This pro- 
duce call 806 is depicted in FIG. 9 and described below ^ , 0 ^ c cogues t0 loop unta ^ hos ts and networks 

Upon termination of the logic associated with procedure call m positioned in a substantiaUy circular arrangement of a 

806. control drops to decision box 807. Referring back to largc enough radius to accommodate all hosts and networks 
decision box 803, if the network number represents a in me network data base> ^cn this occurs 

previously known network (decision path 804), processing (processing path 1005), control passes to termination box 

drops immediately to decision box 807. without executing 45 1007 where me add new hosl procedure 810 terminates, 
procedure call 806. upon completion of the add new network processing 

Beginning at decision box 807 in FIG. 8, the input host logic depicted in FIG. 9 and the add new host processing 

address is checked to determine if the address represents a logic depicted in FIG. 10, a display of the network topology 

new host computer not before represented in the network is generated. 

display. If the host does represent a new host (decision path 50 Referring to FIG. 11, the processing logic associated with 

809), a procedure call 810 is made to add the new host to the procedure call 713 is illustrated. Begmning at processing 

network display. The processing logic associated with the box 1101. the processing necessary in order to display line 

procedure call 810 is illustrated in FIG. 10 and described segments connecting communicating hosts is depicted. First 

below. Once the processing logic associated with procedure a test 1102 is made to determine if the captured information 

call 810 is completed, processing control drops to termina- 33 packet represents a new connection between a transmitting 

tion box 811 where control returns from the address decode an d a receiving host. If this is the case (decision path 1104), 

ing procedure. Referring back to decision box 807, if the the new connection between hosts is inserted into the 

host associated with the input host address does not repre- network data basc (processing box 1105). The new conncc- 

sent an unknown host (decision path 808). processing drops tion is then displayed on the display device as a line segment 

immediately to return box 811 without executing the "add w connecting the transmitting and receiving hosts computers, 

new host" procedure 810. jf mc captured information packet does not represent a new 

Referring now to FIG. 9. the processing logic associated connection (decision path 1103), control drops to processing 

with procedure call 806 is illustrated. Beginning at process- box 1106 without Inserting the new connection into the 

ing box 901, the new network number is inserted in a data network data base. At processing box 1106, the intensity of 

basc of network numbers maintained by the network moni- 6a the connection line segment is incremented to represent 

tor software. The new network number is inserted in such a active information traffic flow on that particular connection 

way as to maintain a sorting of network numbers in sequec- (processing box 1106). Inactive connections are removed 
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from the display after a time out period in processing box 
1107. Control then returns in termination box 1108. 

Although this invention has been shown in relation to a 
particular embodiment it should not be considered so lim- 
ited. Rather, it is limited only by the appended claims. 

What is claimed is: 

1. In a computer display system connected to a computer 
network, said computer display system having a processor, 
a display device coupled to said processor, and a network 
interface coupled to said processor, said network interface 
coupling said computer display system to said computer 
network, said computer network connecting a plurality of 
host computers in a particular topology, a process for 
displaying on said display device a graphical representation 
of said network and information transfer activity occurring 
between said host computers of said network, said process 
comprising the steps of: 

generating a geometric shape substantially resembling a 
circular shape, said geometric shape representing said 
network of host computers, each of said host computers 
being associated with a unique position on said geo- 
metric shape; 

arranging said unique positions associated with said host 
computers in a substantially circular arrangement on or 
near the perimeter of said geometric shape; 

displaying said arrangement on said display device; 

receiving one of one or more information packets trans- 
mitted on said network by one of said host computers; 

decoding information contained in said received informa- 
tion packet; 

compiling a database containing database entries which 
include said information contained in said received 
information packet and traffic data indicating the 
amount of data being transferred between said host 
computers; and 

displaying said information transfer activity with said 
arrangement on said display device by displaying an 
indicia on said arrangement indicating data being trans- 
ferred between said host computers when data is trans- 
ferred between said host computers, wherein the 
appearance of said indicia is related to said traffic data 
contained in said database entries. 

2. The process as claimed in claim 1 further including the 
step of: 

displaying a line segment on said display device connect- 
ing two of said unique positions associated with said 
host computers in response to said information 
obtained in said decoding step, said information indi- 
cating information transfer activity between said host 
computers associated with said two of said unique 
positions, the location of said line segment correspond- 
ing to said information obtained in said decoding step. 

3. The process as claimed in claim 1 wherein said 
arranging step further includes: 

arranging said unique positions associated with said host 
computers in an even distribution on or near the perim- 
eter of said circle. 

4. The process as claimed in claim 1 wherein said 
arranging step further includes: 

summing the number of host computers in said network; 
calculating the dimensions of a polygon, said polygon 
having a number of sides equaling a multiple of two 
times the sum calculated in said summing step; and 
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5. A process according to claim 1, wherein the step of 
displaying said arrangement on said display device further 
comprises indicating the amount of information being trans- 
ferred among said host computers. 

6. A process according to claim 1 wherein the step of 
displaying said arrangement on said display device further 
comprises displaying only active host computers. 

7. A process according to claim 1 wherein said appearance 
of said indicia is modified periodically, the frequency of said 
modifications being determined by a predetermined period, 
and the degree of said modification corresponding to said 
traffic data. 

8. In a computer display system connected to a computer 
network, said computer display system having a processor, 
a display device coupled to said processor, and a network 
interface coupled to said processor, said network interface 
coupling said computer display system to said computer 
network, said computer network connecting a plurality of 
host computers in a particular topology, a process for 
displaying on said display device a graphical representation 
of said network and information transfer activity occurring 
between said host computers of said network, said process 
comprising the steps of: 

generating one or more geometric shapes each substan- 
tially resembling a circular shape, each of said one or 
more geometric shapes representing a sub-network of 
said network of host computers, each of said host 
computers that are members of a particular sub- 
network being associated with a unique position on or 
near the perimeter of the geometric shape representing 
said particular sub-network; 

arranging said one or more geometric shapes in a sub- 
stantially circular arrangement; 

displaying said arrangement on said display device; 

receiving one of one or more information packets trans- 
mitted on said network by one of said host computers; 

decoding information contained in said received informa- 
tion packet; 

compiling a database containing database entries which 
include said information contained in said received 
information packet and traffic data indicating the 
amount of data being transferred between said host 
computers; and 

displaying said information transfer activity with said 
arrangement on said display device by displaying an 
indicia on said arrangement indicating data being trans- 
ferred between said host computers when data is trans- 
ferred between said host computers, wherein the 
appearance of said indicia is related to said traffic data 
contained in said database entries. 

9. The process as claimed in claim 8 further including the 
step of: 

displaying a line segment on said display device connect- 
ing two of said unique positions associated with said 
host computers in response to said information 
obtained in said decoding step, said information indi- 
cating information transfer activity between said host 
computers associated with said two of said unique 
positions, the location of said line segment correspond- 
ing to said information obtained in said decoding step. 

10. The process as claimed in claim 9 wherein said line 
segment connects any two of said positions associated with 
said host computers and is displayed while information 


arranging said unique positions associated with said host 65 packets are being transferred between said host computers 
computers in an even distribution on or near the perim- associated with said positions connected by said line seg- 
eter of said polygon, ment 
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11. The process as claimed in claim 9 wherein said line second window on said display device, said second image 
segment connecting two of said positions associated with being a reduced scale representation of said first image, 
said host computers is removed when information packets 24. The process as claimed in claim 8 wherein said 
cease being transferred between said host computers asso- arranging step further includes: 

dated with said positions connected by said line segment, s calculating the dimensions of a circle; and 

12. The process as claimed in claim 9 wherein said line arranging said geometric shapes representing sub- 
segment connecting said two of said unique positions asso- networks in an even distribution on said circle, 
dated with said host computers is displayed with a distinct 25. The process as claimed in claim 8 wherein said 
particular color, said distinct particular color depending arranging step further includes: 

upon the quantity of information being transferred between io summing the number of geometric shapes associated with 

said host computers associated with said positions connected sub-networks of said network; 

by saidlinc segment calculating the dimensions of a polygon, said polygon 

13. The process as claimed in claim 9 wherein said line naviBg a numbcr of ^ ^ a of ^ 
segment connecting said two of said unique positions asso- t^s the sum calculated in said suniming step; and 
dated with ^said host coitiputers is display 15 { said ^ sh emin sub . 
parucuJar line width, said . cUstoct particular line width networks in an even distribution on or near the perim- 
depcnding upon the quantity of information being trans- eter of said Mlyaoti 

ferred between said host computers associated with said two ^ ^ £ ^ daimed in claim 8 wherein said 

of said unique positions connected by said Line segment. geometric ^ representing sub-networks of said network 

14. The process as claimed in claim 9 wherein said line 20 m nuilti.sio^polygons. 

segment conneding said two of said ^uiuque positions asso- „ The s u daimed ^ claim 8 whercin said 
oated with said host computers is displayed with distinct ; ste ^ iDcludcs: 
characteristics, said distinct charactenstics depending upon " , °. r . ,. . , 
the quantity of information packets transferred between said calculating *e dimensions of a cirde; and 
host coiiiputers associated with said two of said unique 25 *™»8">g said geometric shapes representing sub- 
positions connected by said line segment networks and shapes representing individual host com- 

15. The process as claimed in claim 9 wherein said line P u Jf s ia cven difnbution on said cirde. 
segment connecting said two of said unique positions asso- ^ . Thc as . cl , aimed m claim 8 wherein said 
dated with said host computers is displayed with distind *™n&a& step rurther includes: 

characteristics, said distinct characteristics depending upon 30 summing the number of geometric shapes associated with 

the quantity of bytes of infonnation transfened between said sub-networks of said network with the number of 

host computers associated with said two of said unique shapes representing individual host computers; 

positions connected by said line segment calculating the dimensions of a polygon, said polygon 

16. The process as claimed in claim 9 wherein said line having a number of sides equaling a multiple of two 
segment connecting said two of said unique positions asso- 35 times the sum calculated in said summing step; and 
dated with said host computers is displayed with distinct arranging said geometric shapes representing sub- 
characteristics, said distind characteristics depending upon networks and shapes representing individual host com- 
a network protocol being used to transfer information pack- outers in an even distribution on or near the perimeter 
ets between said host computers associated with said two of of said polygon. 

said unique positions connected by said line segment 40 29. The process as claimed in claim 8 wherein said 

17. The process as daimed in claim 9 wherein said geometric shapes are displayed with distinct characteristics, 
arranging step further comprises labeling said geometric said distinct characteristics depending upon whether at least 
shapes with distinct labels according to names associated one said host computer associated with said geometric shape 
with said geometric shapes, and wherein said displaying step is active or inactive. 

further comprises displaying said labels in association with 45 30. The process as daimed in claim 8 wherein said 

said geometric shapes. positions assodated with said host computers are displayed 

18. The process as claimed in claim 9 wherein said line with distinct characteristics, said distinct characteristics 
segment is displayed only if said information obtained from depending upon whether said host computer assodated with 
said information packet in said decoding step corresponds to each said position is active or inactive. 

a selected network protocol so 31. The process as daimed in claim 8 wherein said 

19. The process as claimed in claim 9 wherein said arranging step further comprises labeling said positions 
geometric shapes and said line segment are displayed as an assodated with said host computers according to names of 
image within a window on said display device. said host computers assodated with said positions, and 

20. The process as claimed in claim 19 wherein a par- wherein said displaying step further comprises displaying 
ticular portion of said image can be selectivdy zoomed such 55 said labels in association with said positions associated with 
that portions of said image other man said particular portion said host computers. ---------- 

are not visible. ^ 32. Thc process as daimed in claim 8 wherein said 

21. The process as claimed in claim 19 wherein said arranging step further comprises labeling said positions 
image can be selectivdy moved horizontally such that assodated with said host computers with distinct labels 
portions of said image are not visible. 60 according to network addresses of said host computers 

22. The process as claimed in claim 19 wherein said assodated with said positions, and wherein said displaying 
image can be selectively moved vertically such that portions step further comprises displaying said labels in assodation 
of said image arc not visible. with said positions associated with said host computers. 

23. The process as claimed in claim 9 wherein said 33. The process as claimed in claim 8 further including thc 
geometric shapes and said line segment are displayed as a 65 steps of: 

first image within a first window on said display device receiving an identification of one of said host computers 

simultaneously with a second image displayed within a assodated with one of said geometric shapes; 
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searching said network for the presence of a host com- 
puter with an identification matching said identification 
received in said receiving step; 

modifying the display of one of said geometric shapes 
associated with said host computer identified in said s 
receiving step if said host computer is found in said 
searching step. 

34. The process as claimed in claim 8 further including the 
steps of: 

receiving an identification of one of said geometric 1Q 
shapes; 

selectively deleting from said display device said geo- 
metric shape identified in said receiving step. 

35. The process as claimed in claim 8 further including the 
steps of: !5 

receiving an identification of one of said host computers 
associated with one of said geometric shapes; 

selectively deleting from said display device said host 
computer identified in said receiving step. 

36. The process as claimed in claim 8 further including the ^ 
steps of: 

receiving at least one information packet sent on said 
network by one of said host computers; 

decoding information contained in said at least one infor- 
mation packet; 23 

displaying a first line segment on said display device 
connecting a position associated with a first host com- 
puter with a position associated with a second host 
computer, said first host computer and said second host 
computer being associated with the same geometric 30 
shape, said second host computer being a gateway for 
said sub-network of which said first host computer and 
said second host computer arc members, said geometric 
shape associated with both said first host computer and 
said second host computer representing said sub- 35 
network; 

displaying a second line segment on said display device 
connecting a position associated with said second host 
computer with a position associated with a third host 
computer, said second host computer and said third 40 
host computer being associated with a different geo- 
metric shape, the location of said first and said second 
line segments corresponding to the information 
obtained in said decoding step. 

37. A process according to claim 8, wherein the step of 45 
displaying said arrangement 00 said display device further 
comprises indicating the amount of information being trans- 
ferred among said host computers. 

38. A process according to claim 8 wherein the step of 
displaying said arrangement on said display device further 50 
comprises displaying only active host computers. 

39. A process according to claim 8 wherein said appear- 
ance of said indicia is modified periodically, the frequency 
of said modifications being determined by a predetermined 
period, and the degree of said modification corresponding to 55 
said traffic data. 

- 40. Id a computer display system connected to a computer 
network, said computer display system having a processor, 
a display device coupled to said processor, and a network 
interface coupled to said processor, said network interface 60 
coupling said computer display system to said computer 
network, said computer network connecting a plurality of 
host computers in a particular topology, a computing device 
for displaying on said display device a graphical represen- 
tation of said network and information transfer activity 65 
occurring between said host computers of said network, said 
computing device comprising: 
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means for generating a geometric shape substantially 
resembling a circular shape, said geometric shape rep- 
resenting said network of host computers, each of said 
host computers being associated with a unique position 
on said geometric shape; 

means for arranging said unique positions associated with 
said host computers in a substantially circular arrange- 
ment on or near the perimeter of said geometric shape; 

means for displaying said arrangement on said display 
device; 

means for receiving one of one or more information 
packets transmitted on said network by one of said host 
computers; 

means for decoding information contained in said 
received information packet; 

means for compiling a database containing database 
entries which include said information contained in 
said received information packet and traffic data indi- 
cating the amount of data being transferred between 
said host computers; and 

means for displaying said information transfer activity 
with said arrangement on said display device by dis- 
playing an indicia on said arrangement indicating data 
being transferred between said host computers when 
date is transferred between said host computers, 
wherein the appearance of said indicia is related to said 
traffic data contained in said database entries. 

41. The computing device as claimed in claim 40 further 
comprising: 

means for displaying a line segment on said display 
device connecting two of said unique positions asso- 
ciated with said host computers in response to said 
information obtained in said decoding step, said infor- 
mation indicating information transfer activity between 
said host computers associated with said two of said 
unique positions, the location of said line segment 
corresponding to said information obtained in said 
decoding step. 

42. The computing device as claimed in claim 40 wherein 
said arranging means further comprises: 

means for arranging said unique positions associated with 
said host computers in an even distribution on or near 
the perimeter of said circle. 

43. The computing device as claimed in claim 40 wherein 
said arr anging means further comprises: 

means for summing the number of host computers in said 
network; 

means for calculating the dimensions of a polygon, said 
polygon having a number of sides equaling a multiple 
of two times the sum calculated in said summing step; 
and 

means for arranging said unique positions associated with 
said host computers in an even distribution on or near 
the perimeter of said polygon. 

44. A process according to claim 40, wherein the step of 
displaying said arrangement on said display device further 
comprises indicating the amount of information being trans- 
ferred among said host computers. 

45. A process according to claim 40 wherein the step of 
displaying said arrangement on said display device further 
comprises displaying only active host computers. 

46. A computing device according to claim 40 wherein 
said appearance of said indicia is modified periodically, the 
frequency of said modifications being determined by a 
predetermined period, and the degree of said modification 
corresponding to said traffic data. 
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47. Id a computer display system connected to a computer a distinct particular color, said distinct particular color 
network, said computer display system having a processor, depending upon the quantity of information being trans- 
a display device coupled to said processor, and a network f erred between said host computers associated with said 
interface coupled to said processor, said network interface positions connected by said line segment 

coupling said computer display system to said computer 5 52. The computing device is claimed in claim 48 wherein 

network, said computer network connecting a plurality of sa *d tine segment connecting said two of said unique posi- 

host computers in a particular topology, a computing device tions associated with said host computers is displayed with 

for displaying on said display device a graphical represen- a distinct particular line width, said distinct particular line 

tation of said network and information transfer activity width depending upon the quantity of information being 
occurring between said host computers of said network, said 10 transferred between said host computers associated with said 

computing device comprising: two of said unique positions connected by said line segment 

means for generating one or more geometric shapes each 53 - ^ computing device as claimed in claim 48 wherein 

substantially resembling a circular shape, each of said said Uoe connecting said two of said unique posi- 

one or more geometric shapes representing a sub- ^ associatcd ^ ^ computers is displayed with 

networkofsaidnetworkofhostcoinputers,eachofsatd distinct characteristics, said distinct characteristics depend- 

host computers that arc members of a particular sub- in 8 U P°° * e quantity of information packets transferred 

network being associated with a unique position on or between said host computers associated with said two of 

near the perimeter of the geometric shape representing said ""V* Positions connected by said line segment 

said particular sub-network; ^ ^ computing device as claimed in claim 48 wherein 

means for arranging said one or more geometric shapes in *> f d Une f? 0BC ^ g said Wo of P 0 ?*; 

a substantially circular arrangement; *°* s W ^ ^T*!? W ? 

_ Jt ; . * distinct characteristics, said distinct characteristics depend- 

n*ans for displaying said arrangement on said display ^ ^ mc quantity of bytes of information transferred 

Ylce ' between said host computers associated with said two of 
means for receiving one of one or more information ^ s ^ unique positions connected by said line segment 

packets transmitted on said network by one of said host 55, The computing device as claimed in claim 48 wherein 

computers; sa id tf n e segment connecting said two of said unique posi- 

means for decoding information contained in said tions associated with said host computers is displayed with 

received information packet; distinct characteristics, said distinct characteristics depend- 
means for compiling a database containing database 30 ing upon a network protocol being used to transfer infor- 

entries which include said information contained in mation packets between said host computers associated with 

said received information packet and traffic data indi- said two of said unique positions connected by said line 

eating the amount of data being transferred between segment 

said host computers; and 56. The computing device as claimed in claim 48 wherein 
means for displaying said information transfer activity 35 said arranging means further comprises labeling said geo- 
with said arrangement on said display device by dis- metric shapes with distinct labels according to names as so- 
playing an indicia on said arrangement indicating data dated with said geometric shapes, and wherein said display- 
being transferred between said host computers when ing step further comprises displaying said labels in 
data is transferred between said host computers, association with said geometric shapes, 
wherein the appearance of said indicia is related to said 40 57. The computing device as claimed in claim 48 wherein 
traffic data contained in said database entries. said Une segment Is displayed only if said information 

48. The computing device as claimed in claim 47 further obtained from said information packet in said decoding step 
comprising: corresponds to a selected protocol. 

means for displaying a line segment on said display 58. The computing device as claimed in claim 48 wherein 

device connecting two of said unique positions as so- 45 sa i<* geometric shapes and said line segment are displayed as 

dated with said host computers in response to said an image within a window on said display device, 

information obtained in said decoding step, said infor- S9 - The computing device as claimed in claim 58 wherein 

mation indicating information transfer activity between a particular portion of said image can be selectively zoomed 

said host computers associated with said two of said such that portions of said image other than said particular 

unique positions, the location of said line segment 50 portion are not visible. 

corresponding to said information obtained in said 60. The computing device as claimed in claim 58 wherein 

decoding step. sa id image can be selectively moved horizontally such mat 

49. The computing device as claimed in claim 48 wherein portions of said image are not visible. 

said line segment connects any two of said positions asso- $1* The computing device as claimed in claim 58 wherein 

dated with said host computers and is displayed while 55 sai<i image can be selectively moved vertically such that 

information packets are being transferred between said host portions of said image are not visible, 

computers associated with said positions connected by said 62. The computing device as claimed in claim 48 wherein 

line segment. sa *d geometric shapes and said line segment are displayed as 

50. The computing device as claimed in claim 48 wherein a first image within a first window on said display device 
said line segment connecting two of said positions assod- 60 simultaneously with a second image displayed within a 
ated with said host computers is removed when information second window on said display device, said second image 
packets cease being transferred between said host computers being a reduced scale representation of said first image, 
associated with said positions connected by said Une seg- 63. The computing device as claimed in claim 47 wherein 
ment said arranging means further comprises: 

51. The computing device as claimed in claim 48 wherein 65 means for calculating the dimensions of a circle; and 
said line segment connecting said two of said unique posi- means for arranging said geometric shapes representing 
tions associated with said host computers is displayed with sub-networks in an even distribution on said cirde. 
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64. The computing device as claimed in claim 47 wherein 
said arranging means further comprises: 

means for summing the number of geometric shapes 
associated with sub-networks of said network; 

means for calculating the dimensions of a polygon, said 5 
polygon having a number of sides equaling a multiple 
of two times the sum calculated in said summing step; 
and 

means for arranging said geometric shapes representing 
sub-networks in an even distribution on or near the 10 
perimeter of said polygon. 

65. The computing device as claimed in claim 47 wherein 
said geometric shapes representing sub-networks of said 
network are multi-sided polygons. 

66. The computing device as claimed in claim 47 wherein 15 
said arranging step further comprises: 

means for calculating the dimensions of a circle; and 
means for arranging said geometric shapes representing 
sub-networks and shapes representing individual host 
computers in an even distribution on said circle. 

67. The computing device as claimed io claim 47 wherein 
said arranging means further comprises: 

means for summing the number of geometric shapes 
associated with sub-networks of said network with the ^ 
number of shapes representing individual host comput- 
ers; 

means for calculating the dimensions of a polygon, said 
polygon having a number of sides equaling a multiple 
of two times the sum calculated in said summing step; ^ 
and 

means for arranging said geometric shapes representing 
sub-networks and shapes representing individual host 
computers in an even distribution on or near the perim- 
eter of said polygon. 35 

68. The computing device as claimed in claim 47 wherein 
said geometric shapes are displayed with distinct 
characteristics, said distinct characteristics depending upon 
whether at least one said host computer associated with said 
geometric shape is active or inactive. 40 

69. The computing device as claimed in claim 47 wherein 
said positions associated with said host computers are dis- 
played with distinct characteristics, said distinct character- 
istics depending upon whether said host computer associated 
with each said position is active or inactive. 45 

70. The computing device as claimed in claim 47 wherein 
said arranging means further comprises labeling said posi- 
tions associated with said host computers with distinct labels 
according to names of said host computers associated with 
said positions, and wherein said displaying step further 50 
comprises displaying said labels in association with said 
positions associated with said host computers. 

71. The computing device as claimed in claim 47 wherein 
said arranging means further comprises labeling said posi- 
tions associated with said host computers with distinct labels 55 
according to network addresses of said host computers 
associated with said positions, and wherein said displaying 
step further comprises displaying said labels in association 
with said positions associated with said host computers. 

72. The computing device as claimed in claim 47 further ^ 
comprising: 

means for receiving an identification of one of said host 
computers associated with one of said geometric 
shapes; 

means for searching said network for the presence of a 63 
host computer with an identification matching said 
identification received in said receiving step; 
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means for modifying the display of one of said geometric 
shapes associated with said host computer identified in 
said receiving step if said host computer is found in said 
searching step. 

73. The computing device as claimed in claim 47 further 
comprising: 

means for receiving an identification of one of said 

geometric shapes; 
means for selectively deleting from said display device 

said geometric shape identified in said receiving step. 

74. The computing device as claimed in claim 47 further 
comprising: 

means for receiving an identification of one of said host 
computers associated with one of said geometric 
shapes; 

means for selectively deleting from said display device 
said host computer identified in said receiving step. 

75. The computing device as claimed in claim 47 further 
comprising: 

means for receiving at least one information packet sent 
on said network by one of said host computers; 

means for decoding information contained in said at least 
one information packet; 

means for displaying a first line segment on said display 
device connecting a position associated with a first host 
computer with a position associated with a second host 
computer* said first host computer and said second host 
computer being associated with the same geometric 
shape, said second host computer being a gateway for 
said sub-network of which said first host computer and 
said second host computer are members, said geometric 
shape associated with both said first host computer and 
said second host computer representing said sub- 
network; 

means for displaying a second line segment on said 
display device connecting a position associated with 
said second host computer with a position associated 
with a third host computer, said second host computer 
and said third host computer being associated with a 
different geometric shape, the location of said first and 
said second line segments corresponding to the infor- 
mation obtained in said decoding step. 

76. A process according to claim 47. wherein the step of 
displaying said arrangement on said display device further 
comprises indicating the amount of information being trans- 
ferred among said host computers. 

77. A process according to claim 47 wherein the step of 
displaying said arrangement on said display device further 
comprises displaying only active host computers. 

78. A computing device according to claim 47 wherein 
said appearance of said indicia is modified periodically, the 
frequency of said modifications being determined by a 
predetermined period, and the degree of said modification 
corresponding to said traffic data. 

79. In a computer display system connected to a computer 
network, said computer, display system having a processor, 
a display device coupled to said processor, and a network 
interface coupled to said processor, said network interface 
coupling said computer display system to said computer 
network, said computer network connecting a plurality of 
host computers in a particular topology, a process for 
displaying on said display device a graphical representation 
of said network and information transfer activity occurring 
between said host computers of said network, said process 
comprising the steps of: 

generating a geometric shape substantially resembling a 
circular shape, said geometric shape representing said 
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network of host computers, each of said host computers 
being associated with a unique position on said geo- 
metric shape; 

arranging said unique positions associated with said host 
computers in a substantially circular arrangement on or s 
near the perimeter of said geometric shape; 

displaying said arrangement on said display device; 

receiving one of one or more information packets trans- 
mitted on said network by one of said host computers; 


26 

decoding information contained in said received informa- 
tion packet; and 

displaying said information transfer activity with said 
arrangement on said display device by displaying an 
indicia on said arrangement indicating data being trans- 
ferred between said host computers when data is trans- 
ferred between said host computers. 

***** 
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